Advice Request Kaspersky blocks gitcdn.link ; Is it a false positive ?

[JB007]

Hello,
I just discovered that Kaspersky blocked "gitcdn.link".
Here Bitdefender détecte sans cesse un Malware I discovered an explanation, "gitcdn.link" is related to github.com and µBlockOrigin.
If this is a false positive what can I do ?
"
Explications du créateur :
Schme16

Yo! I'm the creator of GitCDN - So I can definitivly clear up what it is!
GitCDN is a free service that lets people use their GitHub repositories directly in their apps/websites and have their content browser, and geo, cached.
You'd be finding references to GitCDN in your cookies/logs all the time (it gets used a fair bit). But my guess is that if you're here, it's because you use uBlock. uBlock references some lists by using GitCDN.
I promise I'm not nefarious, but if you ever see content being served from a GitCDN address that is spam, phishing, or illegal, send a notice to me here: https://github.com/schme16/gitcdn.xyz/issues/new with a link to the item that needs to go!
Cheers!
"

 

[Kongo]

Looks like a false positive to me. Just submit it here even tho it tells me that the site is clean at the moment.

Edit: website isn't blocked due to an infection but because of an invalid certificate. Same happens when I try accessing it with Edge:

 

[harlan4096]

It seems a blocking because an issue with certificate...

 

[mlnevese]

Just checked. The site has problems with its certificate, it does not pass site ownership to the browser, for instance.

 

[JB007]

Thanks for the explanations.
But I never tried to accesss this site
What is the relation with µBlock Origin ?

 

[forgottenuser79643]

I am not sure if there was something blocking gitcdn from uBlock's side. But right now the only instance of Gitcdn.* that i could find was in uBlock Filters (built-in default) in the following line which refers to a European CDN service from the company Bunny.Net:

*$script,3p,denyallow=fastly.net|fastlylb.net|jquery.com|hwcdn.net|hcaptcha.com|recaptcha.net|cloudflare.com|cloudflare.net|google.com|googleapis.com|gstatic.com|sharethis.com|stackpathcdn.com|blogger.com|googleusercontent.com|rawgit.com|rawgitcdn.b-cdn.net|githack.com,domain=isaiminiweb.online

It seems to have two links one is GitCDN.link and the other being Gitcdn.xyz. The .link url being the only one having certificate issue. The .xyz seems to be the main marketed url from the developer.

The certificate issue seems to have been reported, and the corresponding issue ticket closed, over a week ago. it seemed the developer had some troubles with Cloudflare and rerouted the traffic of then to the .link url as a temporary fix.

gitcdn.xyz insecure · Issue #1533 · uBlockOrigin/uBlock-issues

Prerequisites I verified that this is not a filter issue Filter issues MUST be reported at filter issue tracker This is not a support issue or a question Support issues and questions are handled at...

github.com

edit: it seems that uBlock is also using the gitcdn service as one of its cdn-urls for some of their own built-in filters/features.
Search for gitcdn.xyz: https://raw.githubusercontent.com/gorhill/uBlock/master/assets/assets.json

 

[JB007]

I am not sure if there was something blocking gitcdn from uBlock's side. But right now the only instance of Gitcdn.* that i could find was in uBlock Filters (built-in default) in the following line which refers to a European CDN service from the company Bunny.Net:

It seems to have two links one is GitCDN.link and the other being Gitcdn.xyz. The .link url being the only one having certificate issue. The .xyz seems to be the main marketed url from the developer.

The certificate issue seems to have been reported, and the corresponding issue ticket closed, over a week ago. it seemed the developer had some troubles with Cloudflare and rerouted the traffic of then to the .link url as a temporary fix.

gitcdn.xyz insecure · Issue #1533 · uBlockOrigin/uBlock-issues

Prerequisites I verified that this is not a filter issue Filter issues MUST be reported at filter issue tracker This is not a support issue or a question Support issues and questions are handled at...

github.com

edit: it seems that uBlock is also using the gitcdn service as one of its cdn-urls for some of their own built-in filters/features.
Search for gitcdn.xyz: https://raw.githubusercontent.com/gorhill/uBlock/master/assets/assets.json

Thanks @rain2reign
And only Kaspersky blocks this site ?

 

[forgottenuser79643]

According to that issue ticket, Bitdefender also had issues.

 

[Venustus]

 

[JB007]

I'm not sure that my understanding is right, but does this mean that the use of µBlock Origin is not safe?

 

[Venustus]

I still think it's safe to use..Maybe some filter lists need to be removed for the time being.
Coincidently, I just received an alert myself from BD

 

[JB007]

I still think it's safe to use..Maybe some filter lists need to be removed for the time being.

Thanks @venustus
But it is not easy to find these faulty filters.

 

[Venustus]

But it is not easy to find these faulty filters.

Agreed..It could be an imported filter list?

 

[JB007]

Agreed..It could be an imported filter list?

You are right.
Maybe it would be safer to disable µBlock Origin and use another blocker until this issue is resolved.

 

[blackice]

I still think it's safe to use..Maybe some filter lists need to be removed for the time being.
Coincidently, I just received an alert myself from BD
View attachment 256244

I just received the same warning, but in dark mode.

 

[blackice]

You are right.
Maybe it would be safer to disable µBlock Origin and use another blocker until this issue is resolved.

May switch to AdGuard for a while until uBo fixes the issue, or just rely on NextDNS for now.

 

[blackice]

Also, just found this from Gorhill.

 

[Venustus]

It's extremey confusing to say the least

 

[JB007]

May switch to AdGuard for a while until uBo fixes the issue, or just rely on NextDNS for now.

Just done the switch to Adguard.

 

[blackice]

gitcdn.xyz insecure · Issue #1533 · uBlockOrigin/uBlock-issues

Prerequisites I verified that this is not a filter issue Filter issues MUST be reported at filter issue tracker This is not a support issue or a question Support issues and questions are handled at...

github.com

But now the .link domain also has the same issue. See my link in post #17. Just an odd situation.